MSSQL RCE without xp_cmdshell (OLE/CLR)

A reachable MSSQL service and an authenticated SQL login are required. Changing the server configuration and running RECONFIGURE requires ALTER SETTINGS (implicitly held by sysadmin and serveradmin); an authenticated login alone is not sufficient. OLE Automation is disabled by default on new SQL Server instances, and using sp_OACreate additionally requires sysadmin membership or direct EXECUTE permission on that procedure. The documented OLE example invokes Windows Command Shell on the SQL Server host and redirects output to a server-side file; the record does not include file readback or confirm successful execution. OLE and CLR are alternative mechanisms, not one required sequence. The CLR branch is incomplete here: the steps enable CLR and enumerate existing assemblies but do not load or invoke an assembly. On SQL Server 2017 and later, clr strict security defaults to enabled and treats permission sets as UNSAFE for runtime purposes, with signing/trust requirements; the generic CLR claim therefore needs a version-specific, evidence-backed workflow before it can be considered verified.